GRCLibrary.ai

Procedure

OT Incident Response Procedure

This procedure defines the operational sequence for responding to security incidents in Operational Technology (OT) environments. It extends the general security incident response procedure (security/procedure-security-incident-response.md) with OT-specific considerations: safety-first decision-making, vendor coordination, longer recovery windows, and integration with safety management.

Type
Procedure
Version
1.3.4
Date
2026-11-01
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Operations: Operational Technology
Review frequency
Annual and following any material OT incident or change to IEC 62443 / NIST SP 800-82
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Guiding principles
  • 4. Roles
  • 5. Severity classification
  • 6. Phase 1: Detection and triage
  • 7. Phase 2: Containment
  • 8. Phase 3: Eradication
  • 9. Phase 4: Recovery
  • 10. Phase 5: Post-incident
  • 11. Communications
  • 12. Forensics in OT
  • 13. Framework alignment

Frameworks it maps to

Related documents